Use the security tab on our GitHub repository and report a vulnerability through there. You should expect updates within five days (possibly longer if we are busy). We will work to fix the vulnerability as soon as possible.